Client-Certificates

Using step-ca 0.30.2 to issue client certificates for mutual TLS, tested end to end with nginx 1.30.5 and Caddy 2.11.7. Why phones are the hard case, raising the 24-hour certificate limit in ca.json, turning the CRL on, why it fails with “different CRL scope” until idpURL and a template add a matching distribution point, the root CRL nginx needs for the whole chain, publishing CRLs over plain HTTP on IPv4 and IPv6, the refresh job that stops an expired CRL locking everyone out, and issuing, packaging, installing and revoking a phone’s certificate.

Locking the Home Assistant app to a client certificate with nginx or Caddy at home, with step-ca as the certificate authority instead of Cloudflare. What changes when Cloudflare leaves the path, an nginx config and a Caddy config each tested with no certificate, a good one, a revoked one and a WebSocket upgrade over IPv4 and IPv6, why nginx can check a CRL and Caddy can only keep an allowlist, the Home Assistant trusted-proxy settings, what the phone needs installed, and where it falls down.

Reaching Home Assistant from the Android app away from home without putting a login page on the internet. How the remote-access options compare on exposure, real cost (machine load and DDoS as well as the bill), blocking risk and battery, why Cloudflare Access and service tokens do not suit the app, how the free-plan client certificates and a WAF custom rule lock a tunnel hostname to the phones that hold a certificate, which Home Assistant settings the reverse proxy needs (trusted proxies, IP banning, external URL, connection security level), building the PKCS12 file, and where it falls down. A self-hosted nginx or Caddy version is a separate post.